Fluxbb is a lightweight forum software platform with a narrowly focused product footprint, yet its position as widely deployed discussion infrastructure makes its vulnerabilities relevant across numerous community and small-business deployments. The vendor's disclosures skew toward serious outcomes and frequently acquire public exploit code, while the recurring weakness classes—cross-site scripting, path traversal, SQL injection, and related input-handling flaws—reflect the web-application attack surface inherent to forum software. Defenders should treat Fluxbb updates as relevant to any hosted or self-managed installations; live severity, exploitation, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Fluxbb over time
Signals from CVEs in this vendor scope (8 CVEs).
8 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2011-3621CRITICAL A reverse proxy issue exists in FluxBB before 1.4.7 when FORUM_BEHIND_REVERSE_PROXY is enabled. | Jan 22, 2020 | 9.8 | 30 | NO | NO |
CVE-2014-10029HIGH SQL injection vulnerability in profile.php in FluxBB before 1.4.13 and 1.5.x before 1.5.7 allows remote attackers to execute arbitrary SQL commands via the req_new_email parameter. | Jan 13, 2015 | 7.5 | 29 | NO | YES |
CVE-2021-43677MEDIUM Fluxbb v1.4.12 is affected by a Cross Site Scripting (XSS) vulnerability. | Jan 4, 2022 | 6.1 | 24 | NO | NO |
CVE-2020-28873HIGH Fluxbb 1.5.11 is affected by a denial of service (DoS) vulnerability by sending an extremely long password via the user login form. When a long password is sent, the password hashi | Mar 17, 2021 | 7.5 | 24 | NO | NO |
CVE-2014-9574HIGH Directory traversal vulnerability in install.php in FluxBB before 1.5.8 allows remote attackers to include and execute arbitrary local install.php files via a .. (dot dot) in the i | Feb 3, 2015 | 9.3 | 23 | NO | NO |
CVE-2020-35240MEDIUM FluxBB 1.5.11 is affected by cross-site scripting (XSS in the Blog Content component. This vulnerability can allow an attacker to inject the XSS payload in "Blog Content" and each | Dec 30, 2020 | 4.8 | 18 | NO | NO |
CVE-2025-44110MEDIUM FluxBB 1.5.11 is vulnerable to Cross Site Scripting (XSS) in via the Forum Description Field in admin_forums.php. | May 15, 2025 | 5.4 | 17 | NO | NO |
CVE-2014-10030MEDIUM Open redirect vulnerability in forums/login.php in FluxBB before 1.4.13 and 1.5.x before 1.5.7 allows remote attackers to redirect users to arbitrary web sites and conduct phishing | Jan 13, 2015 | 5.8 | 16 | NO | NO |
Signals from CVEs in this vendor scope (8 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Fluxbb.
Media articles that mention a CVE ID that affects a product developed by Fluxbb — matched by CVE ID, not by vendor name.